How to choose a Salesforce compliance assessment provider

Where compliance risk hides when the vendor hosts the software

A SaaS estate cannot be over-deployed in the classic sense — Salesforce will not let you provision more seats than you bought. What it can be is mis-used against the contract. The recurring exposures: integration users, where a middleware account or custom app funnels many humans through one licensed identity — the SaaS descendant of the indirect-access question, and the most common serious finding. License-type restriction breaches, where users on cheaper platform licenses work objects and functionality their license type does not permit. Shared and generic logins. Experience Cloud communities licensed on the wrong access model for how they are actually used. And entitlement overruns on the metered edges — storage, API volumes, sandboxes — that telemetry records even when no one inside your organization is watching.

The enforcement mechanics differ from the perpetual world too. Salesforce holds the usage telemetry natively, so compliance questions tend to arrive not as a formal audit letter but as an account-team usage review or a renewal conversation in which the vendor already knows the answer. That asymmetry is the case for an independent assessment: it puts your own numbers in your hands before the conversation where they get used. The work is information-gathering, not a legal proceeding — though as covered below, sometimes it should run under privilege.

What a Salesforce ELP engagement looks like from the inside

It opens with paper, not telemetry. The entitlement baseline is assembled from every order form signed across the life of the relationship, read together with the master agreement and the documentation that defines what each license type permits — an archaeology problem, because estates that grew through years of incremental purchases and the odd acquisition rarely hold a single coherent picture of what they own and under which restrictions. Multi-org estates add an allocation layer: which org consumes which entitlement.

Measurement comes second: user assignments and login patterns, permission sets mapped against license-type boundaries, integration accounts traced to the humans and systems behind them, Experience Cloud usage read against its licensing model, and the metered edges — storage, API calls, sandboxes — counted against what the order forms grant. Then the part that separates an assessment from a spreadsheet: gaps classified by contractual exposure, each finding priced both ways — what it costs to license the usage properly versus what it costs to re-architect the usage away — and the whole file sequenced against the renewal date, because that is where findings become either leverage or liability. Insist on knowledge transfer: the evidence file and the contractual analysis should leave with you, in a form your renewal negotiator can spend.

The provider landscape, with the trade-offs stated plainly

PROVIDER TYPE	STRENGTH	TRADE-OFF TO WEIGH
Independent licensing boutique	Buyer-side only; findings carry no agenda about what you buy next	Confirm Salesforce contract depth specifically — SaaS ELP work is younger than the Oracle and SAP trades many boutiques grew up in
SAM / ITAM consultancy	Reconciliation discipline and evidence-handling rigor from the audit-heavy perpetual world	Check the method is usage-and-contract based, not a discovery-tool process with the vendor name changed
Law firm	Privilege over findings; contract interpretation is the home discipline	Usually subcontracts or co-staffs the technical measurement; strongest when a live dispute or material exposure is plausible
Big 4 / large consultancy	Scale and governance for global multi-org estates; board-ready output	The same houses run Salesforce implementation alliances and sell license reviews on vendor mandates elsewhere; ask about both walls
SaaS management platform	Fast usage measurement; continuous monitoring after the assessment	Contract interpretation — the half of an ELP that decides exposure — is typically outside the tool's competence
The vendor's account team	Free, and already holds the telemetry	A usage review run by the party that profits from the findings is a sales motion, whatever it is called

The cross-vendor version of this landscape, including how ELP work differs at audit-program vendors, is in how to choose a compliance assessment provider.

Four capabilities to verify before shortlisting anyone

Contract archaeology. The entitlement half of a Salesforce ELP is read, not scanned. Ask a candidate how they reconstruct license-type restrictions from a decade of order forms and changing documentation, and what they do when the paper is ambiguous — the honest answer involves documented interpretation positions, not false certainty.

Integration forensics. The biggest exposures sit behind API traffic. A capable firm can trace an integration account to the systems and humans behind it and form a defensible view on whether that pattern needs licensing — and can show you anonymized examples of having done it.

Both cure paths, priced. A finding can be fixed by buying licenses or by re-architecting the usage. A provider who only ever prices the purchase path is doing the vendor's selling; a provider who only ever promises re-architecture is underestimating your engineering backlog. Insist on both numbers per finding.

Independence, tested not asserted. The independence test in short: who else pays this firm, and does any of that revenue depend on Salesforce or on what you buy next? Implementation alliances and reseller margins do not disqualify a candidate — undisclosed ones do.

Six questions that expose the difference

1. Walk us through an anonymized Salesforce ELP you delivered: what the entitlement baseline drew on, what the top findings were, and how each was classified and priced.

2. How do you analyze integration users — what evidence do you collect, and how do you form a view on whether a traffic pattern requires additional licensing?

3. When the contract documents are ambiguous about a license-type restriction, what does your work product say — and who decides what position we take?

4. Under what circumstances would you advise running this engagement under legal privilege, and how do you work with counsel when it is?

5. How do you sequence the assessment against our renewal date so findings become negotiating position rather than mid-term exposure?

6. Who else pays you — Salesforce, resellers, implementation work, tooling — and what happens to your fee if we remediate by buying nothing?

The walk-away signs mirror the questions. Leave the table on guaranteed findings or savings quoted sight-unseen; on a methodology that never mentions the contract documents; on a firm that cannot explain when privilege matters; and on any assessment whose remediation plan is, in effect, a quote. The broader script is in 20 questions to ask a licensing consultant.

Engagement and fee shapes

The standard shape is a fixed-fee assessment scoped by estate size — orgs, users, integration count — and delivered in a defined number of weeks, which keeps candidates comparable and incentives clean. Phased structures (baseline first, deep-dive on flagged areas second) suit estates where nobody knows how deep the water is. Where counsel leads, the assessment firm typically works at day rates under the law firm's engagement. Gain-share is a poor fit for compliance work and worth treating as a warning sign in itself: a fee tied to findings rewards alarmism, and a fee tied to savings rewards underreporting exposure — the incentive mechanics are dissected in the fee models guide. We publish no prices anywhere on this site. Whatever the shape, the evidence file, interpretation positions and deal model must leave with you when the engagement ends.

Frequently asked questions

Does Salesforce run audits the way Oracle or IBM do?

Salesforce contracts carry verification rights, but the vendor rarely needs a formal audit program: as a SaaS provider it already holds the usage telemetry. In practice, compliance questions surface through account-team usage reviews and renewal conversations, where overuse or restricted use becomes commercial leverage. A compliance assessment exists so you see your own position before those conversations, not during them.

What is an effective license position for a SaaS product?

The same reconciliation as in the perpetual world, with different inputs: entitlements assembled from every order form and the agreement documents that define what each license type permits, measured against actual usage — user assignments, permission sets, integration traffic, storage, API and sandbox consumption — across every production org. The output classifies gaps by contractual exposure and prices the remediation paths.

What is the Salesforce equivalent of indirect access?

Integration users. When a middleware connection or a custom app funnels many human users through one or a few licensed accounts, the humans behind it may need their own licenses depending on what the contract documents say about usage. It is the same economic question SAP litigated as indirect access, transplanted to SaaS, and it is the single most common serious finding in a Salesforce compliance assessment.

Should a lawyer be involved in a compliance assessment?

If the assessment might uncover material exposure — or if a vendor conversation about usage is already underway — running the work under legal privilege can keep the findings from being discoverable. Many buyers have counsel engage the assessment firm. For routine pre-renewal hygiene with no live dispute, most assessments run without lawyers; it is a scoping decision to make before work starts, not after a finding lands.

How are firms presented in this directory?

In neutral alphabetical order with balanced pros and cons, never ranked. Independence is shown as a pro; reseller, Big-Four or vendor-side ties are shown as a con — both stated as factual trade-offs for you to weigh.